CVE-2014-6847

The Horoscopes and Dreams aka com.horoscopesanddreams application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5444

Geary

CVE-2014-6833

The AuctionTrac Dealer aka com.adesa.dealer.phone application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6817

The Cove aka org.covechurch.app application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6820

The Amebra Ameba aka jp.honeytrap15.amebra application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Command injection

The Covet Fashion - Shopping Game aka com.crowdstar.covetfashion application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6815

CVE-2014-6815 affects the Android Vouch! app (com.voucherry.voucherry) version 2.1.6, where SSL certificate validation is not performed. The root cause is failure to verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and access sensitive information ...

CVE-2014-6836

The DS photo+ aka com.synology.dsphoto application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6829

The Hook aka com.hook.android application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6821

The CVE-2014-6821 entry concerns the Android app voetbal (nl.jborsje.android.voetbal.az) version 4.7.2, where X.509 certificates are not validated by SSL servers. This root cause enables MITM attackers to spoof servers and potentially access sensitive information via a crafted certificate. Docume...

CVE-2014-6832

CVE-2014-6832 affects the Android app The Bersa Forum (package com.gcspublishing.bersaforum) version 3.9.16. The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and potentially obtain sensitive information via a crafted c...

CVE-2014-6826

The CVE-2014-6826 entry affects the Android app Tic-Tac To The MAX FREE (package com.tothemax) version 1.2, which does not verify X.509 certificates from SSL servers. Root cause: improper TLS certificate validation, enabling a man-in-the-middle to spoof servers and access sensitive information vi...

CVE-2014-5444: Undefined Security Weakness

Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate...

PYSEC-2014-115

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update

An update for Red Hat JBoss Enterprise Application Platform 5.2.0 that fixes two security issues is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CVE-2014-6784

The Fermononrespiri Mobile aka com.tapatalk.rmonlineitforums application 3.8.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The CIH Quiz game aka com.bowenehs.cihquizgameapp application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Cross site request forgery (csrf)

The frank matano aka com.frank.matano application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6804

The Deschutes Public MobileLibrary aka com.bredir.boopsie.deschutes application 4.5.110 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6775

The CVE-2014-6775 entry affects the Android app Light for Pets (com.helenwoodward.light4pets) v1.0, where SSL certificate validation is not performed. This causes potential MITM exploitation to spoof servers and exfiltrate sensitive information via a crafted certificate. Root cause: missing X.509...